on a CentOS 7.4 system I am experiencing the problem, that /run/systemd/sessions contains over 210000 files, which leads to a full /run.

As I am not really familiar with systemd, debugging this problem is a bit complicated. A huge number of the session files belongs to a user (let's call him bob) and the service "crond". This user runs an instance of the monitoring tool "check_mk", which contains a number of cronjobs.

So, bobs oldest session files are from October. All sessions are in the state "closing", this means AFAIK, that the user has logged out, but left a background process.
We currently use systemd-219, in this version "KillUserProcesses" is by default set to "no". I did not change this setting so far, since I fear to break some of the monitoring stuff.

Is there a way to find out, which processes / commands / cronjobs led to the session files and why they where active, even after the user logged out?

It's because you've updated systemd and not rebooted and it's lost its dbus connection. It's a known bug and is fixed in newer systemd versions but I am unsure if the fix will get backported to RHEL 7's systemd. You'll need to search bugzilla.redhat.com and see if there is an existing bz for it and if not, raise one.

CentOS 5 died in March 2017 - migrate NOW!
Full time Geek, part time moderator. Use the FAQ Luke